status.json

{
  "updated": "2026-11-07",
  "product": "KeyLoad development preview. Not production ready.",
  "concept": "Orleans owns cluster membership, placement and activation scaling. The public transport owns each connection and dispatches each admitted operation to an ordinary request grain. Atomic partitions have independent commit owners; metadata has its own owner. Shared volumes require one open owner per physical partition without copies; isolated storage uses typed Orleans Grain Service calls. Physical partition fan-out and deployed shared-volume behavior remain unqualified.",
  "qualification": {
    "build": "The native full-text point capture passed the strict 20-project Debug solution build, format verification and governance with zero compiler warnings/errors. Predecessor 6dd245b6a passed all 33 Linux Build and Tests jobs (42336172768) and Release 42339402864. Exact-source delivery for the point capture is separate.",
    "unitTests": "Original Linux reports on released 6dd245b6a contain 3,095/3,095 functional and 583/583 analyzer cases with no failures or skips. Exactly-once execution passed. The native point capture passed all 392 Search and 187 StorageRecovery cases locally. Numeric coverage remains separate.",
    "processRecoveryTests": "Released 6dd245b6a on Linux and the local native point capture each passed all 154 actual process-recovery cases with no failures or skips. Power-loss qualification is separate.",
    "aspireClusterSdkMcpTests": "Original Linux reports on released 6dd245b6a contain 365/365 real cluster cases, including one/three-node SDK, MCP, SQL, file ownership and abrupt-fault operations, with no failures or skips. Deployed shared-volume, physical fan-out and endurance gates remain open.",
    "coverage": "Numeric product functional coverage remains open, including the 80 line / 70 branch and 90 critical-module thresholds. Compiled inventory, coverage-selector discovery and exact-once execution do not measure this coverage. The Website workflow no longer runs analyzer or authored-website coverage gates.",
    "adminConsole": "open: Blazor Server and Fluent UI components replace the static JavaScript application; Playwright replaces the custom CDP client. Focused browser, complete suite and exact-source Linux qualification must be recorded separately.",
    "performance": "Only original Linux Benchmarks artifacts supply website figures. Run 42326479843 on released 5c5063be0 measured faster one-node document, key-value and SQL operations; full-text results differed by topology and exact vector throughput was lower. Its three-node document and key-value jobs and retries were interrupted without results. Released 6dd245b6a removes repeat copies of owned replica buffers; its comparison is run 42339586942. The native full-text point capture reduced cumulative managed allocation by 29.25% over identical local fixed work with exact results. Published throughput requires a matching image and original comparison artifacts. See docs/implementation/document-keyvalue-performance-review.md.",
    "benchmarkModels": "Each data type has one shared dataset, scenario and driver contract. Canonical comparisons use seed 1729, 16 clients, one million records and 100,000 planned operations per measured case. Time-limited cases report actual completed work. KeyLoad uses one partition per job; three-node full-copy results do not establish physical fan-out.",
    "powerLossDurability": "Not proven; process-kill tests do not prove it.",
    "endurance": "open",
    "sharedVolumeStorage": "open: lazy single-owner sessions are in source; execution runtime, owner loss/reopen and deployed filesystem locking/flush qualification remain required",
    "distributedPartitionQueries": "open: execution logical-partition dispatch is in source; exact owner, budget, authorization and aggregation behavior requires runtime and delivered-source qualification",
    "operationLimits": "The ADR-149 implementation is included in the complete Linux test inventory executed by run 41106618439 on b630b7dffa7b8ca6b48d421ad63f1f2f9d7339d0. Its feature-specific acceptance mapping, numeric functional coverage and endurance remain open.",
    "fileStorage": "open: published ManagedCode.Storage.Server/FileSystem at the approved central pins are composed with metadata-only ZoneTree publication, persisted scope/row authorization, quotas, verified reads and bounded cleanup. Complete Debug solution build and local three-node whole-model SDK/MCP/SQL execution pass, including native HTTP file uploads, exact downloads and denied writes. Physical restore, range/cancellation/endurance and deployed shared-provider cluster qualification remain open; Linux evidence must match the exact committed source and packages."
  },
  "evidence": "Qualification evidence lives only in GitHub Actions runs and their original artifacts for the exact delivered source.",
  "implementation": "Orleans-execution runtime integration is in progress. The commit grain caches copy owners per membership version instead of reading every silo per write; KeyLoad owns no write-ahead log, backup, snapshot or archive format (ADR-011): ZoneTree 2.1.2 owns Shared WAL for MVCC and SyncCompressed WAL for direct resource data, a commit is one ZoneTree transaction with a native physical snapshot timestamp and scope-owned canonical prefixes, acknowledgements require synchronous process-persistent WAL publication, opened native writers are checked before admission, and ZoneTree owns periodic disk sync, and a backup is the store identity plus one native LiveBackup snapshot generation per tree, with independent cuts, restored under a new identity with dispatch paused; the SQL gateway lowers SELECT once to the typed plan and the SDK carries no parser; stateless background workers sweep persisted work with one polling activation per silo and no in-memory buffer; internal grain requests are typed Orleans envelopes validated by scope on every receiving grain, with no per-hop string token or HMAC (ADR-144); native snapshots and serializable conflict retries replace application read/write gates; native maintainers replace the custom cache and cleanup timer; non-transactional tables use a separate native plain tree whose process-persistent WAL publication precedes transactional outcomes; key encoding takes typed components without boxing; the comparison harness has no warm-up phase anywhere. Request handling imposes no concurrency, request-count or reserved-byte admission on callers (ADR-145): the HTTP, command and MCP memory admission pools, the per-connection, per-silo producer and connection caps, the ANN reader caps, the per-engine analytical-read cap, the change-outbox producer quota and progress reserve, and the full-text reader and maintenance-session count caps are gone; only the server-wide request-body limit and the physical reply and protocol bounds remain, and the KeyLoad benchmark cells no longer carry an admission profile. Operations have no configured size or work limits (ADR-149): KeyLoad:DatabaseLimits keeps only the optional queue transfer attempt policies; document size, JSON depth, batch, scan, result, SQL text/depth/token, read-byte, search-token, projection and fixed-deadline refusals are gone; reads count no bytes or records and stop only on caller cancellation, internal request envelopes carry no expiry, complete ranges page through the storage range page, recursive SQL, AST and JSON walkers fail with Validation only when the execution stack runs short, and results, pages and grain request streams have no byte or frame cap (pages are bounded by their record limits). Concurrent canonical commands commit in batches (ADR-146): one reentrant ordinary owner queues each atomic partition, a separate owner orders metadata, the primary prepares and retains exact effects in one native ZoneTree transaction, and copies atomically publish those effects with predecessor and causal-dependency checks; each command keeps its scoped canonical sequence and original outcome, and the last retained exact batch completes an interrupted copy; the engine and store contracts have unit tests, while cluster throughput and fault qualification of the batch path remain open. Queries ordered by ascending document id continue after the last emitted id instead of an offset (ADR-147): a full scan seeks past that id and stops one row past the page, so reading a collection page by page reads each document once, and no query range read asks storage for more than its per-range maximum. Build and Tests first completes one strict solution build (ADR-148), then test jobs consume its compiled artifact without rebuilding. Each Aspire lane runs on its own runner with native discovered ports. The final job requires exact compiled test coverage without duplicate execution, and Release publishes a push to main only after this workflow succeeds for that commit. Each source revision retains its own qualification boundary. IsolatedVolumes uses silo-local full copies; SharedVolume acquires one physical session through an ordinary database activation and joins its borrowers before close. PartitionQuery and DistributedSearch dispatch bounded leaves through ordinary Orleans partition grains and pin one actual owner per logical partition. Workers and durable coordinators use typed owner reads. Complete runtime and delivered-source qualification is open. Ordinary terminal operations use their existing native unary lifetime on each independent ordinary request grain and return a settled Orleans Task reply; progress consumers and composed operations retain native response enumeration. Independent requests still use separate execution grains, fresh persisted authority and joined cleanup. Focused local connection checks and small real SDK diagnostics pass; exact-source Linux runtime and benchmark qualification of this transport change remain open. Published bootstrap text generations now share one native read-only index among independent readers, check only the owned file set at publication, settlement and cleanup, and join retained readers before invalidation, retirement or shutdown. A focused local batch passed 39 functional-assembly executions, 10 process-assembly recovery cases and four real Aspire SDK/MCP authorization/readiness cases, with no unobserved notices in that batch. The single staged bootstrap build and three-generation physical ceiling remain; parallel cold scopes, complete catch-up, endurance and exact-source Linux qualification remain open. Native typed command inputs, request envelopes and replies now replace private nested encoded operation/result buffers. Five auxiliary MemoryStream paths use standard .NET buffer/hash APIs; real key-format controls passed 22 cases. Selected full-text generation qualification remains open; ZoneTree rewrites its own metadata on a clean reopen (ZoneTree issue 209), so KeyLoad no longer hashes engine-owned files (docs/Features/Search/FullTextProjection.md). Commands carry no fingerprint: a retry compares the public input shape of the retained command only when a stored outcome exists (ADR-140), and a resource incarnation is the creating command GUID. A selected full-text search checks the generation's manifest sequence instead of re-reading and hashing the source corpus, reuses the validated manifest and its record maps until the manifest file changes, and keeps the native index open between searches. No competitive performance claim follows from these local changes. Scalar EXPLAIN now describes the access path selected by the same planner used for execution, with seek fields, bound presence, residual fields, read cut, ordering, retained rows and projection; it neither scans candidates nor reports invented costs. Local profiling identified repeated resource-catalog decoding in the KeyLoad storage adapter. A read operation reuses one routing decision only within its immutable native snapshot, with complete key validation. Terminal vector-only searches retain exact top-K when fusion ordering permits it; hybrid and distributed branches retain complete rankings. Graph traversal supports full, vertex-only and count output with the same visibility and traversal semantics. Ordinary HTTP/SQL operations authenticate the credential subject and authorize at their database operation owner; metadata-consuming adapters retain current authority reads. Independent request execution grains remain. These changes carry no competitive or power-loss claim; see docs/implementation/jepsen-particledb-review.md. Partition keys write typed scopes and dynamic suffixes directly into the existing key buffer, without intermediate component lists. Internal decoding reuses Orleans' registered singleton typed serializer with independently pooled sessions. Key bytes, application envelopes, aliases and versions remain unchanged; literal-byte, component-boundary and complete serialization controls retain their qualification gates. Document mutation batches reuse validated collection metadata and current outbox heads inside their transaction. Each added document retains its own row-existence check; fresh permissions, revisions, indexes, native WAL publication and persisted command outcomes remain mandatory. Metadata and data decisions select a common current physical primary so native conflicts protect authorization and resource changes. Local primary execution borrows the joined physical session through DI; remote primary work and copies use typed Orleans Grain Services. Only the selected result copy returns complete outcomes; other copies confirm the persisted sequence and success/error-code decision, and every copy retains complete outcomes for replay. Runtime revision b55245893c93409e41d7ca31edfec967da173045 passed all 33 Linux Build and Tests jobs, including compiled inventories, functional operations, actual process recovery, Aspire SDK/MCP/fault lanes and exactly-once execution (https://github.com/managedcode/KeyLoad/actions/runs/42122435945). Its Release succeeded (https://github.com/managedcode/KeyLoad/actions/runs/42127683554). The original documents cells of Benchmarks run 42128099998 passed all six cases each with one and three persisted copies, the unchanged one-million-record indexed dataset, 16 clients and batches of 256 (https://github.com/managedcode/KeyLoad/actions/runs/42128099998). The requested 30,000 documents per second remains unmet in both configurations. Local no-index HTTP/2 diagnostics are separate investigation evidence. Global data-command ordering and the shared physical position record are removed in the current partition-scoped redesign. Native physical snapshot stamps are distinct from canonical command prefixes. Exact-effect copy batches retain compact typed decisions alongside the original outcome changes. The current design still uses full copies and a common physical primary; independent physical partition fan-out, endurance and power-loss qualification remain separate. The current document/key-value request-path batch removes local progress channels from terminal document commands and SQL/AST queries, avoids repeated ownership copies of already-owned commands, compares immutable lifetime records without binary encoding and reloads publication authority once within its budgeted cut. The complete solution Debug build, formatter, governance, 279 focused functional controls, three actual process-recovery cases and six three-copy SDK/MCP parity cases passed locally. Fresh one-copy and three-copy document diagnostics also passed their full oracles and joined shutdown. Exact-source Linux qualification, Release and new comparison artifacts remain pending; see docs/implementation/document-keyvalue-performance-review.md. Earlier recorded qualification does not qualify this newer runtime. The coordinator/read-path redesign removes per-batch apply activations, repeated same-operation query authority reloads and discarded per-step read-budget timestamps, while retaining caller/stage cancellation, fresh persisted policy at the native data cut and joined physical ownership. The complete build-current-contracts-35 Debug solution passed all 20 projects with zero warnings/errors. Restore, formatting/verification, governance and exactly-once shard assignment passed. The canonical build-33 functional campaign executed all 3094 cases in 27 namespace processes, with 3092 passes and two failures; subsequent complete Messaging execution passed 391/391, and all 123 selected ANN cases passed after the retained-cancellation and healthy-resume test repairs. No cases were skipped. All 154 real process-recovery cases passed, preserving exact outcomes, complete images, cold replay and healthy continuation. Both every-model Aspire SDK/MCP/SQL cases passed on one and three nodes; the public partition-query cases passed under both isolated three-copy and shared-volume one-copy storage, and the three-copy restart/missing-copy fault case passed. The original 250000-document one-copy and 100000-document three-copy SDK diagnostics and separate one-copy profiling cases passed their complete oracles and joined cleanup. Their variable local timings do not establish an isolated speedup or public comparison figure. A possible published Orleans durable-job shard creation/discovery race remains documented; no local binary override was adopted. Six original compiled discovery runs validated all 3094 build-35 cases and the five current selectors. Exact-source Linux qualification, coverage, release and comparison evidence are established by their distinct original workflow artifacts, not these local checks. Physical partition fan-out, deployed shared-filesystem behavior, broader endurance and power-loss qualification remain separate; docs/implementation/document-keyvalue-performance-review.md records the reviewed scope and evidence. The first redesign Linux run 42309640297 on 77d97ee completed with 28 successful jobs and five failed jobs; Release and Benchmarks were skipped. The correction checkpoint preserves complete query/replay data and cold images while respecting physical native-cut identity, cancels short SQL/ANN controls synchronously after real native reads, and retains only closed failure phase/category enums through OTLP privacy processing. The original unexpected post-kill RecoveryRequired response was not reproduced locally; its cause remains unverified and readiness still refuses it. Correction build 41 passed all 20 Debug projects with zero warnings/errors, full format verification and governance. All 31 selected cancellation/privacy controls, seven original atomic/deadline lane cases and four aggregate-replay/root-retention cases passed. The complete SDK/MCP/SQL lane passed 81/81 on build 36. Six fresh discovery selections verified all 3094 cases and their five canonical subsets; no test identities or exclusions changed. Exact-source Linux qualification, release and benchmark outcomes remain separate workflow evidence. Linux run 42317145158 on 357563858 completed with 31 successful jobs and two failed functional jobs on three cases; every previously failing cluster lane passed. The complete correction removes polling-thread observation from all native-read cancellation controls and fixes full-text prepared-intent cleanup when cancellation follows the owned file rename before session assignment. A new actual-filesystem control verifies that precise boundary, unrelated-file preservation and exact healthy republication. Full Debug build 43 passed all 20 projects with zero warnings/errors, full format verification, governance and shard assignment. Complete Search 392/392, ChangeFeeds 56/56, QueryExecution 390/390 and ResourceExecution 196/196 execution passed, as did all 20 selected full-text process-recovery cases and 20 selected controls. Six fresh discovery selections verified all 3095 cases (2662 contributors, 433 required controls) and subsets 533/520/552/491/566, with no exclusions or skips. Exact-source Linux, coverage, release and comparison outcomes are separate original workflow evidence. Released 5c5063be0 passed exact-source Linux Build and Tests and Release. The replica buffer follow-up uses generated immutable exact effects backed by the native staging owner, removing repeated Orleans and replica-staging byte copies while retaining original outcomes and causal checks. The earlier mutable-segment bound and 1 MiB LZ4 block are current; release memory behavior and published comparison qualification of this follow-up remain open. The buffer follow-up passed local native replication 17/17, storage recovery 187/187, process recovery 154/154, all 3,095 discovery identities and five canonical subsets. Its real three-copy 100,000-document SDK workload passed every phase and the exact final data oracle. Generated Orleans code retains effect arrays directly and uses ByteArrayCodec for their contents. Matched bulk-only profiles identify removed copying; native allocation and full released-image qualification remain separate."
}